28
Under Article 4 of the directive, companies that legally reside in multiple
jurisdictions must comply with national rules in each jurisdiction. Thus, because it does not
necessarily matter where data originated, multinational companies must adjust their practices
to national regimes. Similarly, companies that process information on computer equipment
that resides in another country must also abide by the regulations of the country where the
equipment is located.
67
Many of these countries contain data protection practices which
exceed the directive requirements. The problems which emerge from Article 4 demonstrate
the difficulty of regulating a transnational good like personal information.
The “maneuverability” demanded by several member states, industry, and data
protection authorities has produced domestic rules which vary considerably. The Internal
Market Directorate contends that many of these disparities, most notably different
registration requirements, are permitted by the directive and were even forced into the
directive by domestic lobbies during the directive’s development.
68
Extensive variation in
national rules and implementation will most likely persist given the opinion of Frits
Bolkestein, Commission for the Internal Market and Taxation, “the Commission will hesitate
before embarking on any kind of new legislative action, even those that involve minor
amendments.”
69
Consolidating the transnational data protection community
One of the most important results of the directive has been the formation of the
Article 29 working group. Composed of national data protection experts with its secretariat
67
These two provisions limit the harmonization effect of the directive for multinational companies with
multiple affiliates. For example, a German Bank that has an affiliate in Spain may want to share personnel
data between the two locations. If the affiliate in Spain is an independent entity or processing occurs on
equipment located in Spain than the German company must comply with Spanish rules as well as German
legislation.
68
Temmler, J. (2002). Die Evaluierung der Datenshcutzrichtlinie. DAFTA, Cologne, Germany.
Convention